CVE-2025-56295

CVE-2025-56295 affects the code-projects Computer Laboratory System 1.0. The issue is a file upload vulnerability in the avatar modification flow, where the upload feature does not restrict file types, enabling staff to upload malicious PHP backdoor files. This can be leveraged to establish a web...

Linux Distros Unpatched Vulnerability : CVE-2019-13376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking...

Linux Distros Unpatched Vulnerability : CVE-2019-11767

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server side request forgery SSRF in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remo...

Malicious code in avatar-the-way-of-water-online-dkeldez (npm)

The package avatar-the-way-of-water-online-dkeldez was found to contain malicious code...

Malicious code in avatar-the-way-of-water-movie-streaming-edjezkd (npm)

The package avatar-the-way-of-water-movie-streaming-edjezkd was found to contain malicious code...

MAL-2025-46561 Malicious code in watch-avatar-the-way-of-water-2023-ergerfzef (npm)

The package watch-avatar-the-way-of-water-2023-ergerfzef was found to contain malicious code...

MAL-2025-46562 Malicious code in watch-avatar-the-way-of-water-now-dkedke (npm)

The package watch-avatar-the-way-of-water-now-dkedke was found to contain malicious code...

Malicious code in watch-avatar-the-way-of-water-2023-ergerfzef (npm)

The package watch-avatar-the-way-of-water-2023-ergerfzef was found to contain malicious code...

MAL-2025-43548 Malicious code in avatar-the-way-of-water-movie-streaming-edjezkd (npm)

The package avatar-the-way-of-water-movie-streaming-edjezkd was found to contain malicious code...

Malicious code in avatar-the-way-of-water-free-streaming-djzdk (npm)

The package avatar-the-way-of-water-free-streaming-djzdk was found to contain malicious code...

MAL-2025-43549 Malicious code in avatar-the-way-of-water-online-dkeldez (npm)

The package avatar-the-way-of-water-online-dkeldez was found to contain malicious code...

Malicious code in watch-avatar-the-way-of-water-now-dkedke (npm)

The package watch-avatar-the-way-of-water-now-dkedke was found to contain malicious code...

MAL-2025-43547 Malicious code in avatar-the-way-of-water-free-streaming-djzdk (npm)

The package avatar-the-way-of-water-free-streaming-djzdk was found to contain malicious code...

Malicious code in watch-for-free-avatar-the-way-of-water-edzdlzel (npm)

The package watch-for-free-avatar-the-way-of-water-edzdlzel was found to contain malicious code...

MAL-2025-46564 Malicious code in watch-for-free-avatar-the-way-of-water-edzdlzel (npm)

The package watch-for-free-avatar-the-way-of-water-edzdlzel was found to contain malicious code...

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...

CVE-2024-49722

In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

GHSA-CGRG-86M5-XM4W Memos Vulnerable to Stored Cross-Site Scripting

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extractImageInfo function for user avatars. An attacker can execute arbitrary scripts in the context of another user by uploading malicious files that are served without proper content type validation...

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...